How to Set Up BitLocker® Drive Encryption in Windows 10

In
this new era of rampant ransomware attacks and threatening activities on the
internet, setting up a form of encryption is a good idea even if only to
prevent your data landing in the wrong hands.

BitLocker®
first appeared in Windows Vista and later, featuring a full disk encryption for
entire volumes using AES encryption algorithm in Cipher Block Chaining (CBC) or
XTS mode with 128-bit or 256-bit keys. Cipher Block Chaining is not deployed
over the entire disk but applied to each individual sector.

BitLocker Encryption Availability

The
encryption program is not available on all Windows versions however, especially
Windows 7 Professional which is used by multitudes of users. You’ll have to
upgrade to Windows 7 Ultimate to take advantage of this feature.

Windows 8, 8.1 and 10
Pro, Enterprise and Education versions have this feature along with Windows
Server 2008 and later can have their disk drives and removable drives encrypted
using this tool.

BitLocker Encryption Modes

Three authentication
mechanisms exist serving as building blocks to implement BitLocker encryption;

§Trusted Platform Mode (TPM): This
mode ensures a more transparent user experience when accessing your encrypted
drive.A Trusted Platform Modulehardware chip stores the encrypted
keys and releases them to the OS loader code only if the file is unmodified.

§User Authentication Mode: This
requires the user to type in the pre-boot PIN or password set during encryption
process.

§USB Key Mode: This
mode requires the user to insert a USB device containing the key to boot the
OS. The BIOS on the protected machine must support access and reading of USB
drive in a pre-OS environment for this to work.

Set Up Process for BitLocker® Drive Encryption

If you
currently run Windows 7 Professional®, you may want to upgrade to Ultimate
edition or later to activate BitLocker. Advanced functions like TPM would also
require hardware specifications.

8. Select “Enabled”, and ensure
the “Allow BitLocker without a compatible TPM (requires a password or a startup
key on a USB flash drive)” checkbox is also ticked. Click save and Close policy
editor.

9. Relaunch the BitLocker
program and Windows will perform a system configuration check. This process may
take a while depending on drives available and data stored.

10. Windows will now display the
processes involved in turning on BitLocker including preparing the drive and
then encrypting the drive. Click Next to proceed.

11. BitLocker Encryption will now
prepare your drive by shrinking the C: drive, creating new system drive and
finally prepare the drive for BitLocker.

12. Make sure you leave the
checkbox ticked to Run BitLocker system check. This ensures that BitLocker can
read the recovery and encryption keys correctly before encrypting the drive. Continue.

13. You get to choose how much of
your drive to encrypt. Bearing in mind for new drives or PCs, its good practice
to encrypt used disk space only. With PCs that have been in use for a while,
consider choosing to encrypt the entire drive. Click Next to proceed.

14. Two options are available to
unlock the drive at start up. You can insert a USB flash drive with your unlock
key or enter a password to unlock your drive on start up.

15. Remember to choose a strong
secure password containing uppercase and lowercase letters, numbers, symbols
and spaces. Password must be different from your local admin password for
security.

16. Once the password is created,
set up will give you three options to back up your recovery key. It’s up you
which method works best for you, however saving to a Microsoft account requires
you to set up your PC for login using Microsoft account. Find it in the Account
Settings section of control panel.

18. If the BitLocker set up went
successfully, you should see this screen prompting you for a password to unlock
your drive before booting into Windows. TPM chip users may log in directly if
activated.

19. Check the status of your
encryption when you log into Windows. Notice a padlock symbol next to your C:
drive and options to suspend protection, back up recovery key, remove password
and Turn off BitLocker encryption.

Options
for encrypting removable flash drives using BitLocker-To-Go can also be found
in this window.

It is
worth noting that BitLocker works for encrypting virtual hard disks of virtual
machines, while leaving the native OS hard disk unencrypted. This could be an
added layer of security for VM environments.

USB Drive Encryption with BitLocker® Windows 10 Pro

On 25th May 2018, the European Union's General Data Protection Regulation (GDPR) comes into force, issuing hefty monetary fines of up to £500,000 to organizations that fail to adequately protect their user's data. Penalties will reach an upper limit of 20 million Euros or 4% or annual global turn over - whichever is higher. New legislation will require compliance in ISO 27001 information security management, in order to avoid penalties from breaches of personal user data. Businesses risk being penalized with insolvency or complete closure if found in violation, and best time to prepare is now!Encrypting employee data on USB and external hard drives represents the first step your organization's IT team can implement, to ensure compliance to the Data Protection Act. Running from a home lab environment, you may not want to encrypt your main native OS if your're running VMware virtual machines with Windows 10 Pro. Lets take a closer look;20. Launch VMware workstation 12 and boot up Windows 10 Pro virtual machine.

21. Insert the USB or external HDD into the host machine and get a prompt of external devices available to mount on this virtual machine. Click on VM > Removable Devices > Mass Storage > Connect ( Disconnect from Host )

22. Open File Explorer and locate the new removable device now in view. Right Click on the volume and Select Properties. You can now select Turn On BitLocker from the menu.

23. BitLocker will now initialize the drive. You may cancel the operation at this point but never remove the drive until its complete and safe to prevent data corruption.

24. Next step is to enter your secure password required to unlock the drive. The smart card PIN option is also available. Remember to save a recovery key on your system.

25. Drive encryption will now begin after selecting whether to encrypt the entire disk or sections with data. Its worth noting this process can be paused and resumed at a later time. Removing the drive safely ensures data isn't corrupt. The encryption process continues automatically when the external drive is re-inserted.

We hope you enjoyed learning the set up process for encrypting USB and external HDD removable drives in Windows 10 using BitLocker®. Try your hands on encrypting USB sticks and test out to see the results.

Thank you
for investing your time with us.

Credits to all organisations and development teams at Microsoft Corporation